<html>
<head><meta charset="utf-8"><title>zeroed vs uninitialized · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html">zeroed vs uninitialized</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="245749394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245749394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245749394">(Jul 12 2021 at 21:05)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> trying not to litter <a href="https://github.com/rust-lang/rust/pull/87032">https://github.com/rust-lang/rust/pull/87032</a> with my questions, I don't understand your statement "There is no problem that mem::uninitialized has that mem::zeroed does not also have." I'd like to figure out where my mental model differs. Is <code>zeroed::&lt;i32&gt;()</code> UB?</p>



<a name="245750231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245750231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245750231">(Jul 12 2021 at 21:09)</a>:</h4>
<p>The validity invariant of <code>&amp;T</code> bans 0 making zeroed() UB. The validity invariant of <code>u8</code> bans <code>&lt;undef&gt;</code> making uninitialized() UB. I believe the point is basically that in both cases the validity variant of the specific type is the reason the call is UB.</p>



<a name="245750786"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245750786" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245750786">(Jul 12 2021 at 21:13)</a>:</h4>
<p>yes, and the value returned by zeroed is not undef, correct?</p>



<a name="245750949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245750949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245750949">(Jul 12 2021 at 21:15)</a>:</h4>
<p>Correct</p>



<a name="245750986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245750986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245750986">(Jul 12 2021 at 21:15)</a>:</h4>
<p>But is is 0, is is not valid for certain types.</p>



<a name="245751157"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245751157" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bjorn3 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245751157">(Jul 12 2021 at 21:17)</a>:</h4>
<p>You have types that allow undef, 0 and all other values (<code>MaybeUninit</code>). You have types that allow all values except undef (<code>u8</code>) and you have types that accept neither 0 nor undef (<code>&amp;T</code>).</p>



<a name="245751688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245751688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245751688">(Jul 12 2021 at 21:20)</a>:</h4>
<p><span class="user-mention" data-user-id="256342">@bstrie</span> you need to quote the entire paragraph, not just one sentence. :)</p>



<a name="245751702"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245751702" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245751702">(Jul 12 2021 at 21:20)</a>:</h4>
<p>The next sentence is</p>
<blockquote>
<p>"mem::uninitialized just has it for more types, since more types consider uninit memory invalid than consider zeroed memory invalid."</p>
</blockquote>



<a name="245751722"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245751722" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245751722">(Jul 12 2021 at 21:20)</a>:</h4>
<p>so, the difference is in degree, but not quality</p>



<a name="245751764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245751764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245751764">(Jul 12 2021 at 21:21)</a>:</h4>
<p>whereas you seem to say there is a difference in degree here, that <code>uninit</code> has "two problems" where <code>zeroed</code> only has one. that is not the case.</p>



<a name="245752112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245752112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245752112">(Jul 12 2021 at 21:24)</a>:</h4>
<p>some byte in memory being undef is not in any fundamental way different from a byte in memory being 0. those are just 2 of the many different states a byte in memory can be in.<br>
there are types for which zero violates the validity invariant (<code>&amp;i32</code>), and there are types for which undef violates the validity invariant (<code>i32</code>).</p>



<a name="245752525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245752525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245752525">(Jul 12 2021 at 21:27)</a>:</h4>
<p>I dont think it is useful to think of uninit memory as having special rules such as "it is UB to read uninit memory". If you start like that you then need even more special rules to explain why loading padding bytes does not yield UB all the time, and so on. if you make your list of special rules long enough, eventually they will be equivalent to the "official" rules -- but they will be a lot more complicated and non-uniform. (there are many different ways to state the same thing, but some ways are more compact/consistent than others.)</p>



<a name="245764410"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245764410" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245764410">(Jul 12 2021 at 23:52)</a>:</h4>
<p>Ok, I can start to see why it makes sense for a spec author to formulate things this way. At the same time, from the perspective of a user, I think that saying "some byte in memory being undef is not in any fundamental way different from a byte in memory being 0" is liable to violate their intuitive understanding. I'm not saying that your formulation is wrong or that it needs to be changed, only that if a user requests e.g. an uninitialized <code>u8</code>, I think it is reasonable for them to intuit that they will be given a single byte that is one of 256 possible values, from <code>0b0000_0000</code> to <code>0b1111_1111</code>, and that this byte won't have the surprising ability to change when nobody is looking. They'd be wrong, sure, but in communicating to them why they're wrong I think it would be useful to start by expressing the difference between "types that may be undef" and "types that may not be undef", and then to separate the latter into "types that have invalid values" and "types that don't have invalid values". This can be simplified from two steps into one by considering undef to be a value, though I don't think undef matches what most users would think of as a "value". From this perspective I think it's useful to be able to talk about "the set of values that may be invalid, excluding undef", especially since nearly all types cannot be undef.</p>



<a name="245788445"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245788445" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245788445">(Jul 13 2021 at 07:42)</a>:</h4>
<blockquote>
<p>only that if a user requests e.g. an uninitialized u8, I think it is reasonable for them to intuit that they will be given a single byte that is one of 256 possible values, from 0b0000_0000 to 0b1111_1111</p>
</blockquote>
<p>well what I'm basically saying is</p>
<ul>
<li>when talking about bytes in memory, this intuition is wrong and you're better off updating your intuition</li>
<li>when you are actually talking about a <code>u8</code>, the validity invariant excludes uninit bytes, so every <code>u8</code> you ever encounter in Rust will actually have one of 256 values. (though this is not finally settled yet, some people want to allow uninit or ptr provenance in <code>u8</code> and then there'd be more than 256 possible <code>u8</code> values.)</li>
</ul>
<p>however, "uninitialized <code>u8</code>" is at best an extremely misleading statement here, since the uninit byte <code>0xUU</code> is invalid for <code>u8</code>... so while I agree that there's probably many people that would interpret "uninitialized <code>u8</code>" like you say, what I am saying is that that is a problem and we need to be teaching Rust programmers that this way of thinking just leads to confusion and bugs. This way of thinking stems from thinking of C, and by extension Rust, as a very thin layer on top of the hardware. It is thus unable to properly explain the various ways in which the Rust Abstract Machine differs from actual hardware. Uninit is the "easy" case here, pointer provenance is much worse -- and the longer people insist on thinking of Rust's memory model as as being close to that of x86, the longer they will write buggy code.</p>



<a name="245788491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245788491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245788491">(Jul 13 2021 at 07:42)</a>:</h4>
<p>uninit bytes dont "have the surprising ability to change when nobody is looking". this is one of those crutches you simply dont need in "my way" of thinking about these things.</p>



<a name="245788497"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245788497" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245788497">(Jul 13 2021 at 07:42)</a>:</h4>
<p>they are uninit each time you look at them</p>



<a name="245788512"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245788512" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245788512">(Jul 13 2021 at 07:42)</a>:</h4>
<p>there is literally zero non-determinism here</p>



<a name="245788606"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245788606" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245788606">(Jul 13 2021 at 07:43)</a>:</h4>
<p>so I think this mental model you are proposing perpetuates some misconceptions and just further muddies the water of what is already a pit of misunderstandings (since C completely screwed up even specifying this part). but of course your intuition is your own, I can only tell you what I think is the best and simplest way to think about these things -- and I will push for Rust to use this way of thinking in all its docs and teaching material.</p>



<a name="245789267"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245789267" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245789267">(Jul 13 2021 at 07:51)</a>:</h4>
<p>since you are bringing up the concept of a "value" -- I think the best way to define this concept is <a href="https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/value-domain.md">along the lines of what I wrote here</a>: values are "high-level" representations of data, sequences of bytes are "low-level" representations of data, and there is a representation relation that says how the two are connected. the validity invariant is just a consequence of this.</p>



<a name="245789381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/245789381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#245789381">(Jul 13 2021 at 07:52)</a>:</h4>
<p>(Incidentally, this is inspired by what ubsan taught me about C. I think the C standard, when carefully read, also reveals a structure like this. But as usual the C standard leaves all the interesting parts implicit and up to the reader, and very few C programmers probably think this way about "values" in C.)</p>



<a name="246004217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246004217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246004217">(Jul 14 2021 at 19:01)</a>:</h4>
<p>after a full day of reading scattered documentation and ralf's blog posts, maybe I'm wondering if optimizing compilers were simply a mistake :P</p>



<a name="246004441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246004441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> bstrie <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246004441">(Jul 14 2021 at 19:03)</a>:</h4>
<p>I'm wondering if there's a formal term for the sort of weaker "validity invariant" described by this bit in the MaybeUninit docs:</p>
<blockquote>
<p>On top of that, remember that most types have additional invariants beyond merely being considered initialized at the type level. For example, a 1-initialized Vec&lt;T&gt; is considered initialized (under the current implementation; this does not constitute a stable guarantee) because the only requirement the compiler knows about it is that the data pointer must be non-null. Creating such a Vec&lt;T&gt; does not cause immediate undefined behavior, but will cause undefined behavior with most safe operations (including dropping it).</p>
</blockquote>



<a name="246005106"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246005106" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246005106">(Jul 14 2021 at 19:07)</a>:</h4>
<p>I'm pretty sure that's describing the "Safety Invariant"</p>



<a name="246037925"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246037925" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246037925">(Jul 15 2021 at 00:12)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256342">bstrie</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized/near/246004217">said</a>:</p>
<blockquote>
<p>after a full day of reading scattered documentation and ralf's blog posts, maybe I'm wondering if optimizing compilers were simply a mistake :P</p>
</blockquote>
<blockquote>
<p>It's difficult to make transistors any smaller because nature hates us and quantum mechanics are stealing our voltage. Perhaps we should return to the abacus; sometimes, the old ways are the best ways.</p>
</blockquote>



<a name="246047011"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246047011" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246047011">(Jul 15 2021 at 03:02)</a>:</h4>
<p><span class="user-mention silent" data-user-id="232545">Joshua Nelson</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized/near/246037925">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="256342">bstrie</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized/near/246004217">said</a>:</p>
<blockquote>
<p>after a full day of reading scattered documentation and ralf's blog posts, maybe I'm wondering if optimizing compilers were simply a mistake :P</p>
</blockquote>
<blockquote>
<p>It's difficult to make transistors any smaller because nature hates us and quantum mechanics are stealing our voltage. Perhaps we should return to the abacus; sometimes, the old ways are the best ways.</p>
</blockquote>
</blockquote>
<p>Well, I definitely like my compiler optimizations...we just have to pick a consistent model of what compiler optimizations should expect -- that's the hard part because compiler writers have been kinda been wandering in the dark since no one thought to bring a powerful enough flashlight (memory model). Each sees their own light off in the distance, and they end up at different conflicting spots as a result. I'm <a href="https://libre-soc.org/">currently working</a> on building better and hopefully faster CPUs to run all our algorithms on. To me, the future looks bright, partially because there's neat things like <a href="https://en.wikipedia.org/wiki/Superconducting_computing">superconducting digital logic</a> that can use 1/1000 the power and go faster.</p>



<a name="246325373"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246325373" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246325373">(Jul 17 2021 at 13:38)</a>:</h4>
<blockquote>
<p>I'm wondering if there's a formal term for the sort of weaker "validity invariant" described by this bit in the MaybeUninit docs:</p>
</blockquote>
<p>that invariant is <em>stronger</em> -- it requires (in general) strictily more than what the validity invariant requires</p>



<a name="246325448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed%20vs%20uninitialized/near/246325448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized.html#246325448">(Jul 17 2021 at 13:41)</a>:</h4>
<p><span class="user-mention silent" data-user-id="256342">bstrie</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/zeroed.20vs.20uninitialized/near/246004217">said</a>:</p>
<blockquote>
<p>after a full day of reading scattered documentation and ralf's blog posts, maybe I'm wondering if optimizing compilers were simply a mistake :P</p>
</blockquote>
<p>yeah the thought occurred to me as well.^^ but the problem is more the way they have been built, I'd say. a lot of amazing engineering for the compiler data structures and analyses, but not a lot of engineering of the IR as a programming language with a precise spec in its own right.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>